Public API surface map
Routes in the Apex public API v1 contract, grouped by host and authentication.
Public API v1
The public Apex API is the /api/v1/* surface defined by the served OpenAPI contract. Every route below requires an API key unless it is listed under "Routes without API-key authentication". Use /api/v1/openapi.json for methods, request bodies, responses, and schemas.
Dashboard handlers outside /api/v1/* are session-scoped application internals and are intentionally excluded from this map, with one exception: GET /api/exp is the SDK's storefront-configuration transport. It takes a shopId, needs no session or API key, and is served with a public 30-second cache. It is an SDK delivery endpoint, not part of the v1 contract; integrate through the hosted SDK script rather than calling it directly.
The route inventory below is verified against src/lib/api/openapi-spec.ts; its drift test fails if the OpenAPI paths, their operation-level servers, their security declarations, or this list change independently. OpenAPI parameter syntax ({id}) is used verbatim. Routes whose operations declare their own server are served by the events Worker, not the dashboard host, and are listed with the full URL.
Contract routes
/api/v1/account/profile/api/v1/admin/settings/api/v1/admin/shops/{id}/archive/api/v1/admin/shops/{id}/restore/api/v1/admin/tracking/quarantine/api/v1/analytics/entry-exit/api/v1/analytics/geo/api/v1/analytics/pages/api/v1/analytics/realtime/api/v1/analytics/sessions/api/v1/analytics/stats/api/v1/analytics/suggest-goals/api/v1/analytics/timeseries/api/v1/analytics/traffic/api/v1/analytics/url-inventory/api/v1/analytics/visitor-series/api/v1/assets/api/v1/assets/{id}/api/v1/assets/{id}/restore/api/v1/audit-logs/api/v1/backlog/api/v1/backlog/fields/api/v1/backlog/fields/{id}/api/v1/backlog/{id}/api/v1/backlog/{id}/approve/api/v1/backlog/{id}/archive/api/v1/backlog/{id}/design/api/v1/backlog/{id}/reject/api/v1/backlog/{id}/restore/api/v1/brand-context/api/v1/consent/api/v1/data-deletion/api/v1/data-export/api/v1/environments/api/v1/exclusion-groups/api/v1/exclusion-groups/{id}/api/v1/exclusion-groups/{id}/members/api/v1/exclusion-groups/{id}/restore/api/v1/experiments/api/v1/experiments/by-slug/{slug}/api/v1/experiments/conflicts/api/v1/experiments/generate/api/v1/experiments/{id}/api/v1/experiments/{id}/complete/api/v1/experiments/{id}/duplicate/api/v1/experiments/{id}/filesystem/api/v1/experiments/{id}/filesystem/apply/api/v1/experiments/{id}/filesystem/plan/api/v1/experiments/{id}/idea/api/v1/experiments/{id}/pause/api/v1/experiments/{id}/qa/api/v1/experiments/{id}/qa/evidence/api/v1/experiments/{id}/qa/run/api/v1/experiments/{id}/results/api/v1/experiments/{id}/screenshots/api/v1/experiments/{id}/start/api/v1/experiments/{id}/variations/generate/api/v1/experiments/{id}/variations/{variationId}/build/api/v1/experiments/{id}/variations/{variationId}/files/api/v1/experiments/{id}/variations/{variationId}/files/{path}/api/v1/experiments/{id}/variations/{variationId}/revisions/api/v1/experiments/{id}/variations/{variationId}/workspace/api/v1/external-pixels/snippet/api/v1/external-tracking/api/v1/flags/api/v1/flags/{id}/api/v1/flags/{id}/activate/api/v1/flags/{id}/archive/api/v1/flags/{id}/pause/api/v1/flags/{id}/status/api/v1/funnels/api/v1/funnels/{id}/api/v1/funnels/{id}/restore/api/v1/funnels/{id}/run/api/v1/goals/api/v1/goals/{id}/api/v1/goals/{id}/restore/api/v1/harness/sessions/api/v1/harness/sessions/{id}/publish/api/v1/harness/sessions/{id}/versions/api/v1/inbox/messages/api/v1/inbox/read-state/api/v1/install-domains/api/v1/keys/api/v1/keys/{id}/api/v1/landing-pages/api/v1/landing-pages/{id}/api/v1/me/api/v1/me/context/api/v1/org/api/v1/org/invitations/api/v1/org/invitations/{id}/api/v1/org/members/api/v1/org/members/{id}/api/v1/pages/api/v1/pages/{id}/api/v1/personalizations/api/v1/personalizations/{id}/api/v1/personalizations/{id}/activate/api/v1/personalizations/{id}/archive/api/v1/personalizations/{id}/pause/api/v1/preview-sessions/api/v1/roadmap/approved/api/v1/roadmap/items/{id}/handoff/api/v1/runtime-settings/api/v1/runtime-settings/recipes/api/v1/screenshots/{jobId}/api/v1/segments/api/v1/segments/{id}/api/v1/shops/api/v1/shops/{id}/api/v1/shops/{id}/audit-logs/api/v1/shops/{id}/auto-stop/api/v1/shops/{id}/engine/api/v1/shops/{id}/engine/guardrails/api/v1/shops/{id}/engine/interventions/{iid}/rollout/api/v1/shops/{id}/engine/pause/api/v1/shops/{id}/engine/proposals/{pid}/approve/api/v1/shops/{id}/engine/proposals/{pid}/reject/api/v1/shops/{id}/engine/proposals/{pid}/veto/api/v1/shops/{id}/engine/start/api/v1/shops/{id}/engine/stop/api/v1/shops/{id}/guardian/api/v1/shops/{id}/shopware/prebind/api/v1/shops/{id}/store-profile/api/v1/shops/{id}/store-profile/facts/{factId}/api/v1/shops/{id}/store-profile/findings/review/api/v1/shops/{id}/store-profile/learning-runs/api/v1/shops/{id}/testing-defaults/api/v1/signals/api/v1/signals/{id}/api/v1/sos/api/v1/sos/mine/api/v1/targeting/test/api/v1/team/invitations/api/v1/team/invitations/{id}/api/v1/team/members/api/v1/team/members/{id}/api/v1/tracking/discovery/api/v1/tracking/simulate-trigger/api/v1/tracking/verify/api/v1/variations/api/v1/variations/{id}/api/v1/variations/{id}/restore/api/v1/webhooks/api/v1/webhooks/{id}/api/v1/webhooks/{id}/deliveries/api/v1/webhooks/{id}/restore/api/v1/webhooks/{id}/test
Worker runtime routes
Served by the events Worker; the OpenAPI operations declare https://events.drip-apex.com/v1 as their server. Neither route exists on the dashboard host.
https://events.drip-apex.com/v1/assignhttps://events.drip-apex.com/v1/handover/verify
Routes without API-key authentication
These operations declare security: [] in the contract. Handover verification requires a valid X-Drip-Shop header and a signed, unexpired verifyToken in the JSON body. The token must match the resolved shop. A missing or invalid shop header returns 400 before token verification. An invalid, expired, or mismatched token returns 401. No ingest API key is required.
https://events.drip-apex.com/v1/handover/verify